Private equity owns the surveillance economy.

The largest US property-data company was taken private in a $6 billion deal, financed largely with JPMorgan debt.

CoreLogic (NYSE: CLGX) — which holds property records, mortgage history, insurance data, and consumer profiles on nearly every US household — was acquired by Stone Point Capital and Insight Partners. The deal was announced February 4, 2021 and closed June 4, 2021. CoreLogic’s board approved the merger at $80 per share, representing an equity value of approximately $6.0 billion and a 51% premium to its prior unaffected share price. The transaction was financed with equity from both sponsors and committed debt financing from JPMorgan, reported as up to $5.5 billion. CoreLogic’s common stock was delisted from the NYSE on closing. In March 2025, the company rebranded as Cotality.

One of the world’s largest marketing-data companies admitted to selling consumer data to fraud schemes for nearly a decade, then paid $150 million to resolve criminal liability.

Publicis Groupe acquired Epsilon from Alliance Data Systems (ADS) in 2019 for $4.4 billion. Before the sale closed, Epsilon’s direct-to-consumer unit had been knowingly selling consumer lists to mass-mailing fraud schemes targeting elderly people. On January 19, 2021, Epsilon entered a deferred prosecution agreement (DPA) with the DOJ, admitting to the conduct and agreeing to pay $150 million total — $127.5 million of which was designated to compensate victims. The conduct ran from July 2008 through July 2017. ADS indemnified Publicis for all costs under the original sale agreement. Two former Epsilon executives were later convicted at trial.

Barred from selling sensitive location data; must delete historical data.

Gravy Analytics and its subsidiary Venntel collected precise geolocation data from over a billion mobile devices daily by purchasing it from advertising networks and data resellers — not by asking users. Venntel sold this data exclusively to public-sector clients: ICE, CBP, the FBI, and other DHS components used it to track individuals, including in the US–Mexico border region. The FTC charged both companies with violating the FTC Act by selling sensitive location data without verifiable user consent and inferring sensitive characteristics — health conditions, political activities, religious affiliation — from location patterns. The final order prohibits the companies from selling, disclosing, or using sensitive location data going forward and requires deletion of three years of historical data.

Nearly four years of litigation ended with a ban on selling sensitive location data without affirmative consent.

The FTC sued Kochava in August 2022 alleging it collected precise location data from hundreds of millions of mobile devices and sold it in ways that revealed visits to health facilities, places of worship, reproductive health clinics, homeless shelters, and addiction recovery centers. Kochava contested the case for nearly four years before settling. The Commission approved the stipulated final order 2–0 on May 4, 2026. Under the order, Kochava and its subsidiary Collective Data Solutions are prohibited from selling, licensing, or disclosing sensitive location data unless they obtain a consumer’s affirmative express consent and the data is used only to provide a service the consumer directly requested.

State and local police access to location histories — without a warrant — for under $10,000 a year.

Fog Data Science is not a federal contractor — it targeted local police, sheriffs, and state highway patrols. A 2022 Electronic Frontier Foundation investigation based on over 100 public-records requests found that Fog sold access to its location database to at least 18 state, local, and federal law enforcement agencies. Fog claimed 15 billion data points daily from 250 million US devices, sourced from thousands of smartphone apps via advertising identifiers. One county paid $9,000 for a one-year license. EFF found no evidence that agencies obtained warrants before querying the system.

Locate X uses the advertising ID to query a device’s full location history — no warrant required.

Babel Street is backed by Veritas Capital, a PE firm with approximately $45 billion in assets under management that specializes in technology and national-security companies. Babel Street’s Locate X product aggregates mobile-device location data from advertising bid streams and SDK-based feeds and presents it as a queryable database. An operator can draw a geofence around any location and retrieve a list of every device that passed through — along with where those devices had been before and after. FOIA records obtained by journalists document Locate X contracts with the US Secret Service, the IRS’s Office of Foreign Assets Control (OFAC), US Customs and Border Protection, and ICE. CBP and ICE use it to track movement in the US–Mexico border region. Babel Street acquired OSINT firm Vertical Knowledge in January 2024.

A Nebraska surveillance firm was combined with an Israeli intelligence-technology company in a PE-driven roll-up. ICE has spent over $5 million on their tools since 2021.

New York-based Spire Capital acquired a controlling interest in PenLink, a Lincoln, Nebraska communications-surveillance company, in April 2022. In July 2023, Spire used the same investment vehicle to acquire Cobwebs Technologies — an Israeli OSINT firm founded by former Israeli intelligence officers — for approximately $200 million and merged it into PenLink. The merger added Cobwebs’ two flagship products to PenLink’s suite: Tangles (an AI-powered open-source intelligence tool that scrapes the open, deep, and dark web and builds facial-recognition-enabled dossiers) and Webloc (which queries databases of mobile phone advertising-ID location data to track devices in a given area and time window). ICE has spent over $5 million on these tools since 2021, including a $2.3 million contract signed in fall 2025 for Tangles and Webloc.

$6.9 billion. Identity governance and administration — managing who has access to what, across an enterprise.

SailPoint was taken private from the NYSE. At the time of acquisition, it was the leading independent provider of identity governance software for large enterprises.

$2.8 billion. Customer and workforce identity — access management for large enterprises and their customers.

Ping Identity was also taken private from the NYSE. Its customer base included more than half of the Fortune 100.

$2.3 billion. Customer identity and access management — then merged into Ping Identity after US DOJ cleared the deal.

The ForgeRock acquisition triggered a US Department of Justice antitrust review because Ping Identity and ForgeRock were direct competitors. The DOJ cleared the transaction in August 2023. Thoma Bravo immediately announced it would merge the two companies. ForgeRock CEO Fran Rosch departed; Ping Identity founder Andre Durand led the combined entity. The three acquisitions totaled approximately $12 billion and brought SailPoint, Ping, and ForgeRock — formerly independent public companies — under a single private owner.

Francisco Partners acquired a majority stake in NSO Group for a reported ~$130 million and oversaw a period of rapid market expansion.

Francisco Partners is a San Francisco-based technology-focused PE firm. Under its ownership, NSO expanded sales of Pegasus to customers including governments in Mexico, Panama, and Saudi Arabia, per reporting by Reuters and the Financial Times. Francisco Partners also acquired Circles — a separate Israeli surveillance firm specializing in SS7 phone-network geolocation — for a reported ~$130 million in 2014, eventually merging it into the NSO corporate family.

Note: NSO Group is a private company. Acquisition prices for private transactions are reported by financial press (Reuters, FT, Bloomberg) rather than available in public filings.

NSO was sold to its founders, backed by UK PE firm Novalpina Capital, at a reported ~$1 billion valuation — then the Pegasus scandal unraveled Novalpina’s fund.

Novalpina Capital’s limited partner base included Oregon’s public pension fund, which had committed $233 million. As reporting on Pegasus’s use against civil-society targets accelerated in 2021 — culminating in the Forbidden Stories “Pegasus Project” — Novalpina’s limited partners voted to liquidate the fund. Control of NSO passed to consultancy Berkeley Research Group. NSO was added to the US Commerce Department’s Entity List in November 2021, restricting US companies from selling technology to it.